ReadonlycategoryWhich trap category this detector addresses
ReadonlyidUnique identifier for this detector
ReadonlynameHuman-readable name
Protected ReadonlytrapProtectedredactLast chance to alter matched text before it becomes Threat.evidence.
Evidence travels: into ScanResult, the CLI's JSON/SARIF output, audit
records, and whatever the caller logs. For most detectors the matched text
IS the finding and must be preserved verbatim. For a detector whose matches
are themselves secrets, echoing them would leak the credential into exactly
the CI logs and audit trails the scan was meant to protect. Override to
redact; the default is identity.
Sanitization is unaffected — it works from Threat.location, not evidence.
Return sanitized content with threats neutralized
Scan content and return any threats found
Optionaloptions: DetectorOptions
Detects instructions injected via HTML metadata channels that agents parse but humans don't see: HTML comments, aria-label, alt text, meta tags.
Research shows that injecting adversarial instructions into HTML elements like metadata and aria-label tags alters generated summaries in 15-29% of cases (Verma and Yadav, 2025).